darkcomet | f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-10-2024 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Size

1.3MB
MD5

6463d8b3b095662598d9823df35c5c70
SHA1

6ec181e03393deba51664099dc1e8f3ad5041909
SHA256

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384
SHA512

10c630672fb873857f71129998daab94054a6fb8573f2cd62b6090dba2b987d1ce776ef9bb115a8cf8356a987cb02107d7e4ffe6a2461598d40c7ba7817625fe
SSDEEP

24576:Ej6wLhExiZNzXaAc4yc3fNs5OzlKT8FGdg1XaNWtrA5jdv2s9toMWuYc2Z/T:EmwLhbraAly0fZzlZGdgsMt03Os97WuY

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windupdt\\winupdate.exe"	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exewinupdate.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winupdate.exe

Executes dropped EXE 1 IoCs

Processes:

winupdate.exe

pid	Process
2740	winupdate.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exewinupdate.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	winupdate.exe

Loads dropped DLL 4 IoCs

Processes:

6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exewinupdate.exe

pid	Process
2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
2740	winupdate.exe
2740	winupdate.exe
2740	winupdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windupdt\\winupdate.exe"	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exewinupdate.exe

pid	Process
2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
2740	winupdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

winupdate.exe6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exeDllHost.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winupdate.exe6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winupdate.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exewinupdate.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winupdate.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exewinupdate.exe

pid	Process
2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
2740	winupdate.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exewinupdate.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeSecurityPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeBackupPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeRestorePrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeShutdownPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeDebugPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeUndockPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: 33	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: 34	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: 35	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2740	winupdate.exe
Token: SeSecurityPrivilege	2740	winupdate.exe
Token: SeTakeOwnershipPrivilege	2740	winupdate.exe
Token: SeLoadDriverPrivilege	2740	winupdate.exe
Token: SeSystemProfilePrivilege	2740	winupdate.exe
Token: SeSystemtimePrivilege	2740	winupdate.exe
Token: SeProfSingleProcessPrivilege	2740	winupdate.exe
Token: SeIncBasePriorityPrivilege	2740	winupdate.exe
Token: SeCreatePagefilePrivilege	2740	winupdate.exe
Token: SeBackupPrivilege	2740	winupdate.exe
Token: SeRestorePrivilege	2740	winupdate.exe
Token: SeShutdownPrivilege	2740	winupdate.exe
Token: SeDebugPrivilege	2740	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2740	winupdate.exe
Token: SeChangeNotifyPrivilege	2740	winupdate.exe
Token: SeRemoteShutdownPrivilege	2740	winupdate.exe
Token: SeUndockPrivilege	2740	winupdate.exe
Token: SeManageVolumePrivilege	2740	winupdate.exe
Token: SeImpersonatePrivilege	2740	winupdate.exe
Token: SeCreateGlobalPrivilege	2740	winupdate.exe
Token: 33	2740	winupdate.exe
Token: 34	2740	winupdate.exe
Token: 35	2740	winupdate.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid	Process
2956	DllHost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

DllHost.exe

pid	Process
2956	DllHost.exe
2956	DllHost.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2484 wrote to memory of 2740	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2740	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2740	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2740	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2740	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2740	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2740	2484	6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6463d8b3b095662598d9823df35c5c70_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\ProgramData\Microsoft\Windows\Start Menu\Windupdt\winupdate.exe
  "C:\ProgramData\Microsoft\Windows\Start Menu\Windupdt\winupdate.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2740

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Windupdt\winupdate.exe

Filesize
1.3MB

MD5
6463d8b3b095662598d9823df35c5c70

SHA1
6ec181e03393deba51664099dc1e8f3ad5041909

SHA256
f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384

SHA512
10c630672fb873857f71129998daab94054a6fb8573f2cd62b6090dba2b987d1ce776ef9bb115a8cf8356a987cb02107d7e4ffe6a2461598d40c7ba7817625fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\I-LOVE-YOU-I-HATE-YOU.JPG

Filesize
29KB

MD5
cbff8e34ba2a48833132e4352ee89a51

SHA1
f96c65311a24b09315aaf83701b9117bc6916bd0

SHA256
5c178508280b885187eb411475f98a220c214870942afce6932b74284bd3cbb9

SHA512
6d9702a312ce1cef9bbf191a5df51d606238a80c705f0e78a051ce234fb12569fff52594e1ada4686ea0ac249d189fdfab02f2d3a92c013ebcc107ae4883793b

Download Submit
memory/2484-0-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2484-1-0x0000000000340000-0x00000000003A0000-memory.dmp

Filesize
384KB

Download
memory/2484-29-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-28-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-27-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-26-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-25-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-24-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-23-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-22-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-21-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-20-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-19-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-18-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-17-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-16-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-15-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-14-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2484-13-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/2484-12-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/2484-11-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/2484-10-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/2484-9-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/2484-8-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/2484-7-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/2484-6-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2484-5-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/2484-4-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/2484-3-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/2484-2-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2484-30-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2484-32-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2484-35-0x0000000007150000-0x0000000007152000-memory.dmp

Filesize
8KB

Download
memory/2484-45-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2484-44-0x0000000007790000-0x0000000007A4A000-memory.dmp

Filesize
2.7MB

Download
memory/2484-42-0x0000000000340000-0x00000000003A0000-memory.dmp

Filesize
384KB

Download
memory/2740-48-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-53-0x0000000000D30000-0x0000000000FEA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-52-0x0000000000D30000-0x0000000000FEA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-54-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-55-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-56-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-57-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-58-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-59-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-60-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-61-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-62-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-63-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-64-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-65-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-66-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-67-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-68-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2740-69-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2956-36-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download